CVE-2025-11621

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2025-11621

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-11621.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2025-11621

Aliases

Downstream

MINI-w34j-hg35-wmg4

openSUSE-SU-2025:15710-1

Related

Published

2025-10-23T19:15:48.893Z

Modified

2026-03-23T05:07:17.349140911Z

Severity

8.1 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N CVSS Calculator

Summary

[none]

Details

Vault and Vault Enterprise’s (“Vault”) AWS Auth method may be susceptible to authentication bypass if the role of the configured boundprincipaliam is the same across AWS accounts, or uses a wildcard. This vulnerability, CVE-2025-11621, is fixed in Vault Community Edition 1.21.0 and Vault Enterprise 1.21.0, 1.20.5, 1.19.11, and 1.16.27

References

https://discuss.hashicorp.com/t/hcsec-2025-30-vault-aws-auth-method-authentication-bypass-through-mishandling-of-cache-entries/76709

Affected packages

Git / github.com/hashicorp/vault

Affected ranges

Type

GIT

Repo

https://github.com/hashicorp/vault

Events

Introduced

d2d0aa07d079836c9a5bd258479b019ca00eb6b8

Fixed

818ca8b3575ea937ca48b640baf35e1b2ede1833

Database specific

{
    "versions": [
        {
            "introduced": "0.6.0"
        },
        {
            "fixed": "1.21.0"
        }
    ]
}

Affected versions

api/auth/approle/v0.*

api/auth/approle/v0.1.0

api/auth/approle/v0.1.1

api/auth/approle/v0.10.0

api/auth/approle/v0.2.0

api/auth/approle/v0.3.0

api/auth/approle/v0.4.0

api/auth/approle/v0.4.1

api/auth/approle/v0.5.0

api/auth/approle/v0.6.0

api/auth/approle/v0.7.0

api/auth/approle/v0.8.0

api/auth/approle/v0.9.0

api/auth/aws/v0.*

api/auth/aws/v0.1.0

api/auth/aws/v0.10.0

api/auth/aws/v0.2.0

api/auth/aws/v0.3.0

api/auth/aws/v0.4.0

api/auth/aws/v0.4.1

api/auth/aws/v0.5.0

api/auth/aws/v0.6.0

api/auth/aws/v0.7.0

api/auth/aws/v0.8.0

api/auth/aws/v0.9.0

api/auth/azure/v0.*

api/auth/azure/v0.1.0

api/auth/azure/v0.2.0

api/auth/azure/v0.3.0

api/auth/azure/v0.4.0

api/auth/azure/v0.4.1

api/auth/azure/v0.5.0

api/auth/azure/v0.6.0

api/auth/azure/v0.7.0

api/auth/azure/v0.8.0

api/auth/azure/v0.9.0

api/auth/gcp/v0.*

api/auth/gcp/v0.1.0

api/auth/gcp/v0.10.0

api/auth/gcp/v0.2.0

api/auth/gcp/v0.3.0

api/auth/gcp/v0.4.0

api/auth/gcp/v0.4.1

api/auth/gcp/v0.5.0

api/auth/gcp/v0.6.0

api/auth/gcp/v0.7.0

api/auth/gcp/v0.8.0

api/auth/gcp/v0.9.0

api/auth/kubernetes/v0.*

api/auth/kubernetes/v0.1.0

api/auth/kubernetes/v0.10.0

api/auth/kubernetes/v0.2.0

api/auth/kubernetes/v0.3.0

api/auth/kubernetes/v0.4.0

api/auth/kubernetes/v0.4.1

api/auth/kubernetes/v0.5.0

api/auth/kubernetes/v0.6.0

api/auth/kubernetes/v0.7.0

api/auth/kubernetes/v0.8.0

api/auth/kubernetes/v0.9.0

api/auth/ldap/v0.*

api/auth/ldap/v0.1.0

api/auth/ldap/v0.10.0

api/auth/ldap/v0.2.0

api/auth/ldap/v0.3.0

api/auth/ldap/v0.4.0

api/auth/ldap/v0.4.1

api/auth/ldap/v0.5.0

api/auth/ldap/v0.6.0

api/auth/ldap/v0.7.0

api/auth/ldap/v0.8.0

api/auth/ldap/v0.9.0

api/auth/userpass/v0.*

api/auth/userpass/v0.1.0

api/auth/userpass/v0.10.0

api/auth/userpass/v0.2.0

api/auth/userpass/v0.3.0

api/auth/userpass/v0.4.0

api/auth/userpass/v0.4.1

api/auth/userpass/v0.5.0

api/auth/userpass/v0.6.0

api/auth/userpass/v0.7.0

api/auth/userpass/v0.8.0

api/auth/userpass/v0.9.0

api/v1.*

api/v1.0.1

api/v1.0.2

api/v1.0.3

api/v1.0.4

api/v1.1.1

api/v1.10.0

api/v1.11.0

api/v1.12.0

api/v1.12.1

api/v1.12.2

api/v1.13.0

api/v1.14.0

api/v1.15.0

api/v1.16.0

api/v1.2.0

api/v1.20.0

api/v1.21.0

api/v1.3.1

api/v1.5.0

api/v1.6.0

api/v1.7.0

api/v1.7.1

api/v1.7.2

api/v1.8.0

api/v1.8.1

api/v1.8.2

api/v1.8.3

api/v1.9.0

api/v1.9.1

api/v1.9.2

Other

last-go-modable

main-creation

sdk/v0.*

sdk/v0.1.10

sdk/v0.1.11

sdk/v0.1.12

sdk/v0.1.13

sdk/v0.1.8

sdk/v0.1.9

sdk/v0.10.0

sdk/v0.10.1

sdk/v0.11.0

sdk/v0.11.1

sdk/v0.12.0

sdk/v0.13.0

sdk/v0.14.0

sdk/v0.14.1

sdk/v0.15.0

sdk/v0.16.0

sdk/v0.17.0

sdk/v0.18.0

sdk/v0.19.0

sdk/v0.2.1

sdk/v0.3.0

sdk/v0.4.1

sdk/v0.5.0

sdk/v0.5.1

sdk/v0.5.3

sdk/v0.6.0

sdk/v0.6.1

sdk/v0.6.2

sdk/v0.7.0

sdk/v0.8.0

sdk/v0.9.0

sdk/v0.9.1

sdk/v0.9.2

v0.*

v0.10.0

v0.10.0-rc1

v0.10.1

v0.10.2

v0.10.3

v0.10.4

v0.11.0

v0.11.0-beta1

v0.11.1

v0.11.2

v0.11.3

v0.11.4

v0.6.0-rebuild

v0.6.1

v0.6.1-rc1

v0.6.1-rc2

v0.6.1-rc3

v0.6.2

v0.6.3

v0.6.4

v0.6.5

v0.7.0

v0.7.0-beta1

v0.7.1

v0.7.2

v0.7.3

v0.8.0

v0.8.0-beta1

v0.8.0-rc1

v0.8.1

v0.8.2

v0.8.3

v0.9.0

v0.9.1

v0.9.2

v0.9.3

v0.9.4

v0.9.5

v0.9.6

v1.*

v1.0.0

v1.0.0-beta1

v1.0.0-beta2

v1.0.0-rc1

v1.0.1

v1.0.2

v1.0.3

v1.1.0

v1.1.0-beta1

v1.1.0-beta2

v1.1.1

v1.1.2

v1.2.0

v1.2.0-beta1

v1.2.0-beta2

v1.2.0-rc1

v1.21.0-rc1

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-11621.json"

unresolved_ranges

[
    {
        "events": [
            {
                "introduced": "0.6.0"
            },
            {
                "fixed": "1.16.27"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "1.18.0"
            },
            {
                "last_affected": "1.18.15"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "1.19.0"
            },
            {
                "fixed": "1.19.11"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "1.20.0"
            },
            {
                "fixed": "1.20.5"
            }
        ]
    }
]